Your setup link
A new account has no password. Instead, your hosting provider gives you a setup link to a single-use page where you choose your own credentials before your first sign-in. Two things follow:
- Nobody ever knows a password of yours, not even your provider.
- Once used, a copy of the link in a chat log or an email thread is worthless to whoever finds it.
You get the same kind of link whenever somebody resets your credentials, e.g. after you lose access.
The moment a reset link is issued, your old password stops working and every signed-in session is signed out.
Two ways in
Your provider gives you one of these. Both open the same setup page.
| What you get | Notes | |
|---|---|---|
| Setup link | A one-click URL. | Open it and press Begin setup. The link is only used up by the button, so a link scanner or preview bot can't burn it. |
| Claim page and PIN | A short address, your username, and an eight-digit PIN. | Convenient for a hand-off over the phone. Spaces in the PIN don't matter. |
A few wrong PIN attempts in a row cancel the link, and a link expires after three days. Either way, ask your provider for a new one; an expired link can't be recovered, by design.
Choose how you sign in
The setup page offers two kinds of credential. You need at least one and can set up both.
- A passkey. Sign in with your device's fingerprint, face, or PIN: the most secure option, and no password. With only a passkey, your account is passwordless from day one.
- A password. Choose one, with a strength meter, or let the page generate a strong one. With a password set, the page also offers two-factor authentication: scan the QR code with an authenticator app, then store the backup codes it gives you.
Store it before you leave the page. The page can't show it again.
Finish and sign in appears only once you have a working credential, so the flow can't lock you out. Press it to go to the sign-in page.
The setup session lasts about half an hour. If it expires before you finish, ask your provider for a new link.
After you're in
Everything you set here can be changed later on Password & Security: change the password, add passkeys, set up the authenticator app again, or go fully passwordless.